Difference between revisions of "KRACK Vulnerability"
Jump to navigation
Jump to search
m |
m |
||
| Line 2: | Line 2: | ||
This page is specifically written to help members to understand the most relevant aspects of '''KRACK''' Wi-Fi attacks. | This page is specifically written to help members to understand the most relevant aspects of '''KRACK''' Wi-Fi attacks. | ||
=What is KRACK?= | |||
* KRACK stands for Key Re-installation Attack and refers to attacks on Wi-Fi networks using weaknesses in the WPA2 protocol which secures most modern protected Wi-Fi networks. | * KRACK stands for Key Re-installation Attack and refers to attacks on Wi-Fi networks using weaknesses in the WPA2 protocol which secures most modern protected Wi-Fi networks. | ||
* KRACK allow attackers to read and access information on Wi-Fi networks that were considered secured. | * KRACK allow attackers to read and access information on Wi-Fi networks that were considered secured. | ||
| Line 9: | Line 9: | ||
** Encrypt (or conceal) the data shared over the network between the access point (Router) and clients (computers, phones, tablets, etc). Encryption is done by using the Wi-Fi password to generate an even stronger key that is used to encrypt the data between the access point and client. | ** Encrypt (or conceal) the data shared over the network between the access point (Router) and clients (computers, phones, tablets, etc). Encryption is done by using the Wi-Fi password to generate an even stronger key that is used to encrypt the data between the access point and client. | ||
=Why should I care?= | |||
* WPA2 is widely used and is presently the strongest form of Wi-Fi security available to the average person including modems configured by NCF. | * WPA2 is widely used and is presently the strongest form of Wi-Fi security available to the average person including modems configured by NCF. | ||
* Almost every client device is vulnerable to KRACK whether on Wi-Fi at home or elsewhere. | * Almost every client device is vulnerable to KRACK whether on Wi-Fi at home or elsewhere. | ||
** Variations of KRACK can be used against clients of various kinds including devices running Android, Apple, Windows and Linux OSs. | ** Variations of KRACK can be used against clients of various kinds including devices running Android, Apple, Windows and Linux OSs. | ||
=Should I be worried?= | |||
'''NO'''. Why? | '''NO'''. Why? | ||
* '''NCF modems with standard configuration are NOT VULNERABLE to KRACK.''' Nevertheless, NCF will continue the practice of making firmware updates available as they become available from our modem providers. | * '''NCF modems with standard configuration are NOT VULNERABLE to KRACK.''' Nevertheless, NCF will continue the practice of making firmware updates available as they become available from our modem providers. | ||
| Line 24: | Line 24: | ||
* Time: This attack works only during periods of connection and re-connection of your client device to a Wi-Fi network. As such, an attacker has a very limited time window in which to attempt this attack (usually a few seconds). | * Time: This attack works only during periods of connection and re-connection of your client device to a Wi-Fi network. As such, an attacker has a very limited time window in which to attempt this attack (usually a few seconds). | ||
=What should I do?= | |||
[[File:HTTPS_ncf.PNG|300px|thumb|right|NCF website showing secure logo]] | [[File:HTTPS_ncf.PNG|300px|thumb|right|NCF website showing secure logo]] | ||
# Update the operating system on your phone, computer and other client devices when they receive security updates. Each device you update becomes protected against the KRACK vulnerability. | # Update the operating system on your phone, computer and other client devices when they receive security updates. Each device you update becomes protected against the KRACK vulnerability. | ||
| Line 36: | Line 36: | ||
# Consider using a [[Virtual_Private_Networks|VPN]] service. | # Consider using a [[Virtual_Private_Networks|VPN]] service. | ||
=External links= | |||
*[https://www.krackattacks.com/ Krack Attacks Website by Mathy Vanhoef of imec-DistriNet] | *[https://www.krackattacks.com/ Krack Attacks Website by Mathy Vanhoef of imec-DistriNet] | ||
*[https://www.krackattacks.com/#faq Krack Attacks FAQ] | *[https://www.krackattacks.com/#faq Krack Attacks FAQ] | ||
Revision as of 15:44, 28 July 2018
This page is specifically written to help members to understand the most relevant aspects of KRACK Wi-Fi attacks.
What is KRACK?
- KRACK stands for Key Re-installation Attack and refers to attacks on Wi-Fi networks using weaknesses in the WPA2 protocol which secures most modern protected Wi-Fi networks.
- KRACK allow attackers to read and access information on Wi-Fi networks that were considered secured.
- Wi-Fi networks use a password through WPA2 for two general purposes:
- Controlling who can connect to the network; and
- Encrypt (or conceal) the data shared over the network between the access point (Router) and clients (computers, phones, tablets, etc). Encryption is done by using the Wi-Fi password to generate an even stronger key that is used to encrypt the data between the access point and client.
Why should I care?
- WPA2 is widely used and is presently the strongest form of Wi-Fi security available to the average person including modems configured by NCF.
- Almost every client device is vulnerable to KRACK whether on Wi-Fi at home or elsewhere.
- Variations of KRACK can be used against clients of various kinds including devices running Android, Apple, Windows and Linux OSs.
Should I be worried?
NO. Why?
- NCF modems with standard configuration are NOT VULNERABLE to KRACK. Nevertheless, NCF will continue the practice of making firmware updates available as they become available from our modem providers.
- Modems or routers connected to each other in a wireless chain (using WDS) are potentially at risk unless a firmware patch is applied.
- Also, other networking devices like Wi-Fi repeaters and extenders which are not connected to your modem by Ethernet may be vulnerable.
- And, although your modem/router may not be vulnerable, your client devices may be. Updating your devices with a security patch that address KRACK will protect each device from this vulnerability.
- Vulnerability vs. Infection: Be vigilant but not anxious. A security vulnerability on a device does not mean that the device is already infected or has a high likelihood of being infected. Follow the recommendations in the sections below to be safe against this vulnerability and keep informed.
- Proximity: An attacker needs to be within Wi-Fi range of your network (close enough to connect to your Wi-Fi).
- Time: This attack works only during periods of connection and re-connection of your client device to a Wi-Fi network. As such, an attacker has a very limited time window in which to attempt this attack (usually a few seconds).
What should I do?
- Update the operating system on your phone, computer and other client devices when they receive security updates. Each device you update becomes protected against the KRACK vulnerability.
- Do not trust Wi-Fi outside of your home (public Wi-Fi). KRACK is just one of many known security risks associated with using public Wi-Fi. Using a trusted Virtual Private Network (VPN) service is one way of keeping your data encrypted on public Wi-Fi.
- Connect your devices, where possible, to the router by Ethernet cables, especially those without an available security update.
- Use HTTPS to connect to secured services and websites. This means information transmitted to such web pages will have end-to-end encryption. Web pages that use HTTPS or another secure connection will include HTTPS in the URL.
- Check on your browser's address bar to ensure the above. If your browser shows a little lock in the address bar and says "secure," you should be safe.
- HTTPS Everywhere for Chrome
- HTTPS Everywhere for Mozilla Firefox
- Consider using a VPN service.
External links
- Krack Attacks Website by Mathy Vanhoef of imec-DistriNet
- Krack Attacks FAQ
- Microsoft Security TechCenter KRACK Update
- Ars Technica Reports on KRACK
- NCF Discussion Group on KRACK
- TP-Link KRACKs Vulnerability Statement
- Good online references for understanding some of the terms used in this article are Webopedia and Wikipedia